Exploiting Extra CPU Cores to Detect NOP Sleds Using Sandboxed Execution

Abstract

At present, antivirus software backed by database of virus signatures is the most popular solution to malware detection problem. Even though its shortfalls are well-known - it requires large database that needs to be updated constantly and it is vulnerable to zero-day exploit - the security community has not successfully come up with better alternatives to it. However, the advent of multicores allows us to revisit this problem and look for alternatives that were deemed inefficient with previous generations of hardware.This paper proposes a lightweight dynamic analysis scheme that scans and executes objects allocated in the main memory. Our scheme looks for the presence of NOP sleds, which signals the existence of malware. Separate threads are spawn or woken up to perform object execution in sandboxed environment. This action takes place whenever applications allocate objects in memory. Extra CPU cores can execute these threads independently in parallel, providing close to ideal speedup. Our solution obviates the need for the virus database and can protect against zero-day exploit. We show that our dynamic analysis approach incurs low overhead, offers attractive false positive rate, and maintains zero false negative rate by design.